Data Breach Notification Policy

A Data Breach Notification Policy in the United States sets out the rules and standards the organisation expects those it covers to follow.

The legal obligation to notify affected individuals of data breaches is one of the most pervasive compliance requirements in US law. All 50 US states, the District of Columbia, Puerto Rico, Guam, and the US Virgin Islands have enacted data breach notification statutes. Although these laws vary significantly in their definitions, timelines, and content requirements, they share a common structure: when personal information is acquired without authorization by an unauthorized person, the organization holding that data must notify affected individuals and, in most states, notify a state regulator.

Federal sector-specific laws add additional layers. The Health Insurance Portability and Accountability Act (HIPAA) Security Rule (45 CFR §§ 164.302-318) and the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414) require covered entities — hospitals, clinics, health insurers, and their business associates — to notify affected individuals within 60 days of discovering a breach of protected health information (PHI), notify the US Department of Health and Human Services (HHS), and for breaches affecting 500 or more residents of a state or jurisdiction, notify prominent media outlets in that state. The FTC's Standards for Safeguarding Customer Information (the Safeguards Rule, 16 CFR Part 314), updated in 2021, require financial institutions covered by the Gramm-Leach-Bliley Act (GLBA) to notify the FTC within 30 days of discovering a breach affecting 500 or more customers.

A Data Breach Notification Policy is distinct from an Incident Response Plan (IRP) — a broader cybersecurity document that covers all types of security incidents including those that do not involve personal data — and from a Privacy Policy. The Notification Policy is the specific subset of the IRP that addresses the legal compliance obligations triggered by a notifiable data breach: who decides whether a breach is notifiable, who drafts the notification letters, who notifies regulators, and what records are maintained to document compliance.

The Federal Trade Commission (FTC) has used its Section 5 authority under the FTC Act (15 U.S.C. § 45) to take enforcement action against companies with inadequate data breach response programs, including against Equifax (2019 settlement of up to $700 million), Capital One, and numerous smaller organizations. A documented Data Breach Notification Policy provides evidence that the organization maintains reasonable security practices — a critical factor in FTC investigations and state attorney general enforcement actions.

A US Data Breach Notification Policy is needed by every organization that collects, stores, or processes personal information about US residents — which, given the breadth of state breach notification laws, encompasses virtually every business, nonprofit, educational institution, and government entity operating in the United States.

For healthcare organizations — hospitals, physician practices, health insurers, pharmacy benefit managers, and their IT vendors and business associates — a Data Breach Notification Policy is required by HIPAA's Breach Notification Rule (45 CFR § 164.400). The HHS Office for Civil Rights (OCR) actively enforces HIPAA breach notification requirements and maintains a public breach portal tracking all reported breaches affecting 500 or more individuals. OCR has imposed civil monetary penalties ranging from $100 to $1.9 million per violation category per year, with annual caps up to $1.9 million.

For financial services companies subject to the Gramm-Leach-Bliley Act — including banks, credit unions, mortgage lenders, insurance companies, and securities broker-dealers — the FTC Safeguards Rule (16 CFR Part 314) and federal banking regulators' guidance (OCC, FDIC, Federal Reserve, NCUA) require written information security programs that include incident response and notification procedures. California financial institutions are also subject to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) breach notification provisions under California Civil Code § 1798.82.

For retail businesses, e-commerce companies, and other organizations handling consumer payment card data, the Payment Card Industry Data Security Standard (PCI DSS) — a contractual requirement imposed by Visa, Mastercard, American Express, Discover, and JCB — requires an incident response plan and breach notification procedure as part of PCI DSS Requirement 12.10.

Schools and educational institutions handling student records under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g) need Data Breach Notification Policies that address both FERPA's privacy obligations and applicable state breach notification laws, which generally apply to educational institutions as data holders.

Any organization that suffered a prior data breach — or that operates in a sector targeted by ransomware, phishing, or supply chain attacks, including technology companies in California, financial firms in New York, and energy companies in Texas — needs a documented Data Breach Notification Policy to satisfy regulators, cyber liability insurers, and business partners who conduct vendor security assessments.

A complete US Data Breach Notification Policy must address the full lifecycle of a breach response, from initial detection through final regulatory reporting. The following components are essential in any professionally prepared policy.

The scope and definitions section defines key terms: what constitutes "personal information" covered by the policy (name plus Social Security number, financial account number, driver's license number, medical information, biometric data, or other identifiers specified by applicable state laws including California Civil Code § 1798.82, New York General Business Law § 899-aa, and Texas Business & Commerce Code § 521.002); what constitutes a "breach" requiring notification (unauthorized acquisition of unencrypted personal information, as distinguished from mere unauthorized access without acquisition); and which organizational units and data systems are covered.

The breach detection and reporting procedures section specifies how employees, contractors, and IT staff identify and report potential security incidents, the internal escalation path from initial report to the designated Incident Response Team (IRT), and the time standard for internal escalation — typically 24 to 48 hours after detection, to allow timely regulatory notification downstream.

The investigation and risk assessment section establishes the process for determining whether a security incident constitutes a notifiable breach. This assessment applies the applicable legal standard: most states require notification upon unauthorized acquisition of unencrypted personal information; HIPAA requires a four-factor risk assessment under 45 CFR § 164.402 to determine whether there is a low probability that PHI was compromised. The policy should specify who conducts the assessment (internal counsel, outside counsel, forensic investigators), what documentation is required, and the maximum time allowed before a notification decision is made — typically no more than 30 days from discovery, to comply with the strictest state notification timelines.

The notification procedures section specifies the required content of individual breach notifications (type of breach, categories of information involved, steps taken to mitigate harm, contact information, and credit monitoring offers), the method of notification (written letter, email, or substitute notice by website posting and media for breaches affecting large numbers of individuals), and the procedures for notifying state attorneys general, the HHS OCR, the FTC, banking regulators, and other agencies as required by applicable law.

The recordkeeping section requires the organization to document all aspects of each breach investigation and notification response — forensic investigation reports, risk assessment conclusions, notification letters and mailing records, regulatory filings, and internal communications — for the applicable statute of limitations period. For HIPAA covered entities, breach documentation must be retained for 6 years under 45 CFR § 164.414(b).

The policy review and testing section requires annual review of the policy and tabletop exercises simulating breach scenarios to test the IRT's readiness. Insurers providing cyber liability coverage — a standard requirement for technology companies, healthcare organizations, and financial institutions — frequently require evidence of annual policy review and testing as a condition of coverage.